import time

''' pcap file analysis main function '''
def pcaps_analysis(pcaps):
    res = []
    for i in range(len(pcaps)):
        No = i + 1
        ltime = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(int(pcaps[i].time)))
        source = ''
        destination = ''
        protocol = ''
        length = len(pcaps[i])
        information = ''

        # Ethernet
        if pcaps[i].haslayer('Ether'):
            # IPv4
            if pcaps[i].type == 2048:
                source = pcaps[i]['IP'].src
                destination = pcaps[i]['IP'].dst
                information = pcaps[i].show(dump=True)
                # TCP
                if pcaps[i].proto == 6:
                    # HTTP
                    if pcaps[i].sport == 80 or pcaps[i].dport == 80:
                        if pcaps[i].haslayer('Raw'):
                            if pcaps[i].load.find(b'HTTP') != -1 and pcaps[i]['TCP'].flags == 0x18:
                                protocol = 'HTTP'
                                information = pcaps[i].load.splitlines()[0].decode()
                            else:
                                protocol = 'TCP'
                        else:
                            protocol = 'TCP'

                    # HTTPS
                    elif pcaps[i].sport == 443 or pcaps[i].dport == 443:
                        if pcaps[i].haslayer('Raw') and pcaps[i]['TCP'].flags == 0x18:
                            protocol = 'TLS'
                        else:
                            protocol = 'TCP'

                    else:
                        protocol = 'UnKnown'
                        information = "Can't analyze the pcapng packet"
                # UDP
                elif pcaps[i].proto == 17:
                    # DNS
                    if pcaps[i].haslayer('DNS'):
                        protocol = 'DNS'

                    # SSDP
                    elif pcaps[i].sport == 1900 or pcaps[i].dport == 1900:
                        protocol = 'SSDP'

                    # DHCP
                    elif pcaps[i].sport == 67 or pcaps[i].dport == 67:
                        protocol = 'DHCP'

                    else:
                        protocol = 'UnKnown'
                        information = "Can't analyze the pcapng packet"
                # ICMP
                elif pcaps[i].proto == 58:
                    protocol = 'ICMP'

                else:
                    protocol = 'UnKnown'
                    information = "Can't analyze the pcapng packet"

            # IPv6
            elif pcaps[i].type == 34525:
                source = pcaps[i]['IPv6'].src
                destination = pcaps[i]['IPv6'].dst
                information = pcaps[i].show(dump=True)
                # TCP
                if pcaps[i].nh == 6:
                    # HTTP
                    if pcaps[i].sport == 80 or pcaps[i].dport == 80:
                        if pcaps[i].haslayer('Raw'):
                            if pcaps[i].load.find(b'HTTP') != -1 and pcaps[i]['TCP'].flags == 0x18:
                                protocol = 'HTTP'
                                information = pcaps[i].load.splitlines()[0].decode()
                            else:
                                protocol = 'TCP'
                        else:
                            protocol = 'TCP'

                    # HTTPS
                    elif pcaps[i].sport == 443 or pcaps[i].dport == 443:
                        if pcaps[i].haslayer('Raw') and pcaps[i]['TCP'].flags == 0x18:
                            protocol = 'TLS'
                        else:
                            protocol = 'TCP'

                    else:
                        protocol = 'UnKnown'
                        information = "Can't analyze the pcapng packet"


                # UDP
                elif pcaps[i].nh == 17:
                    # DNS
                    if pcaps[i].haslayer('DNS'):
                        protocol = 'DNS'

                    # SSDP
                    elif pcaps[i].sport == 1900 or pcaps[i].dport == 1900:
                        protocol = 'SSDP'

                    # DHCP
                    elif pcaps[i].sport == 67 or pcaps[i].dport == 67:
                        protocol = 'DHCP'

                    else:
                        protocol = 'UnKnown'
                        information = "Can't analyze the pcapng packet"
                # ICMPv6
                elif pcaps[i].nh == 58:
                    protocol = 'ICMPv6'

                else:
                    protocol = 'UnKnown'
                information = "Can't analyze the pcapng packet"

            else:
                source = pcaps[i].src
                destination = pcaps[i].dst

                # ARP
                if pcaps[i].type == 2054:
                    protocol = 'ARP'
                    # ARP request
                    if pcaps[i].op == 1:
                        # ARP Probe
                        if pcaps[i].psrc == '0.0.0.0':
                            information = f"Who has {pcaps[i].pdst}? (ARP Probe)"

                        elif pcaps[i].pdst != pcaps[i].psrc:
                            information = f"Who has {pcaps[i].pdst}? Tell {pcaps[i].psrc}"
                        # ARP Announcement
                        else:
                            information = f"ARP Announcement for {pcaps[i].psrc}"
                    # ARP reply
                    elif pcaps[i].op == 2:
                        information = f"{pcaps[i].psrc} is at {pcaps[i].hwsrc}"

                # Unknown protocol
                else:
                    protocol = 'UnKnown'
                    information = "Can't analyze the pcapng packet"
        # Loopback
        elif pcaps[i].haslayer('Loopback'):
            # IPv4
            if pcaps[i].type == 2048:
                source = '127.0.0.1'
                destination = '127.0.0.1'
            # IPv6
            else:
                source = '::1'
                destination = '::1'
        res.append([No, ltime, source, destination, protocol, length, information])
    return res